Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1BB03852112812F3FD547CAE4F2B5B3249379CA9DDBF345A8AEAE03A2C387C54D613594 |
|
CONTENT
ssdeep
|
768:GtRdNFWULqhkphz5aKz5vHz5INIz5/9z5zuz5zR18LU3kQW4qBiDPRoPkaNcFD+a:rUpph8KJHCI19luHmA0DxgQkgcx+6/Xd |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
a3931c4c715d5d65 |
|
VISUAL
aHash
|
7fffffef00000000 |
|
VISUAL
dHash
|
bcedeacb8f33b3cc |
|
VISUAL
wHash
|
7fffffff40000000 |
|
VISUAL
colorHash
|
12c00008000 |
|
VISUAL
cropResistant
|
7499d9da585bda5a,0000000606000000,bcedeacb8f33b3cc |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 193030 techniques to evade detection by security scanners and make reverse engineering more difficult.